CVE-2024-8956
📋 TL;DR
PTZOptics PT30X-SDI/NDI cameras with firmware before 6.3.40 have an authentication bypass vulnerability in the param.cgi endpoint. Attackers can remotely access and modify sensitive configuration data without credentials, including usernames, password hashes, and camera settings. Organizations using these cameras for live streaming or surveillance are affected.
💻 Affected Systems
- PTZOptics PT30X-SDI/NDI series cameras
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete camera compromise allowing configuration overwrite, credential theft, and potential lateral movement to connected systems.
Likely Case
Unauthorized access to sensitive camera configurations, credential harvesting, and camera settings manipulation.
If Mitigated
Limited impact if cameras are isolated on internal networks with strict firewall rules.
🎯 Exploit Status
Exploitation requires only HTTP requests to the vulnerable endpoint without authentication headers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware 6.3.40
Vendor Advisory: https://ptzoptics.com/firmware-changelog/
Restart Required: Yes
Instructions:
1. Download firmware 6.3.40 from PTZOptics support site. 2. Access camera web interface. 3. Navigate to firmware update section. 4. Upload and apply the new firmware. 5. Reboot camera after update completes.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLANs with strict firewall rules blocking external access to camera management interfaces.
Access Control Lists
allImplement IP-based restrictions to only allow authorized management stations to access camera web interfaces.
🧯 If You Can't Patch
- Segment cameras on isolated networks with no internet access
- Implement strict firewall rules blocking all external access to camera management ports (typically 80, 443, 554)
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[camera-ip]/cgi-bin/param.cgi without Authorization header. If it returns configuration data, the camera is vulnerable.Check Version:
Check camera web interface System Information page or send HTTP request to camera status endpointVerify Fix Applied:
After updating to firmware 6.3.40, repeat the vulnerable check. It should return authentication error or no data.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful param.cgi access
- Unusual configuration changes in camera logs
Network Indicators:
- HTTP requests to /cgi-bin/param.cgi without Authorization headers
- Unusual traffic patterns to camera management interfaces
SIEM Query:
source_ip="camera_network" AND (url_path="/cgi-bin/param.cgi" AND NOT http_headers CONTAINS "Authorization:")🔗 References
- https://ptzoptics.com/firmware-changelog/
- https://vulncheck.com/advisories/ptzoptics-insufficient-auth
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8956
- https://www.greynoise.io/blog/greynoise-intelligence-discovers-zero-day-vulnerabilities-in-live-streaming-cameras-with-the-help-of-ai
- https://www.labs.greynoise.io/grimoire/2024-10-31-sift-0-day-rce/
